A high risk merchant account is an ordinary card-processing account with a bank that has agreed to carry more risk than Stripe or PayPal will, and charges for it through reserves, higher rates and a lot more paperwork. For a peptide store, it’s usually the only card route that lasts.
It isn’t a loophole. The providers who sell it as one (“guaranteed approval”, “we’ll code you as supplements”) are the ones who get merchants terminated six months later.
This post covers what the account actually is, why peptide merchants land in this category, the documents you’ll need, what the terms typically look like, and how to put together an application that an underwriter can approve without holding their nose.
What a high risk merchant account actually is
When you use Stripe, PayPal or Square, you’re a sub-merchant under their master account. Onboarding takes minutes because the real review happens later, often after you’ve processed a few thousand dollars. That’s why closures feel sudden.
A merchant account works the other way round. You get your own merchant ID (MID) with an acquiring bank, and the bank reviews your business before you take a single payment. The chain usually looks like this:
- You, the merchant.
- An ISO or broker, which sells and services the account.
- The acquiring bank, which holds the relationship with Visa and Mastercard and makes the final decision.
- The card networks, which set rules the acquirer has to follow.
“High risk” means the acquirer has put your business in a category it monitors more closely and prices accordingly. For some categories the networks require the acquirer to register you. Visa’s Integrity Risk Program says “An acquirer must register each High-Integrity Risk account with Visa before allowing the merchant to accept payments,” and processor sources report that registration fee rose from $500 to $950 from 1 April 2024. Mastercard has its own registration list, which includes “pharmaceutical and tobacco product merchants”, and a processor summary reports its annual registration fee rising from $500 to $1,000 per merchant from 1 May 2026 (not yet checked against a Mastercard bulletin). These fees are billed to the acquirer, and you’ll often see them reflected in your setup or annual fees.
Why peptide stores land in high risk
Not because Visa has a line that says “peptides”. The VIRP sources we’ve reviewed don’t name peptides, nutraceuticals or supplements at all. Visa’s top tier includes merchant category codes 5122 and 5912, which cover drugs and drug stores, so a peptide merchant falls there only if it’s coded as a drug seller. The acquirer decides how to classify you, based on what you sell and how you sell it.
What drives the classification is a stack of risk the bank can see:
- Regulatory risk. The FDA has rejected “research use only” disclaimers in warning letters from February 2025 through August 2026 when the rest of a site pointed to human use.
- Industry scrutiny. LegitScript’s October 2025 guide to peptides for payment processors lists red flags including “Not for Human Consumption” disclaimers, no buyer-qualification step and lab-style catalogs of injectable vials.
- Chargebacks. Peptide orders produce disputes from descriptor confusion, shipping delays and friendly fraud.
- Network penalties for the bank. LegitScript describes Mastercard BRAM fines running “well into the six figures per transaction” for brand-damaging activity.
Put those together and you can see why a bank wants a reserve, a higher rate and a thick file before it says yes.
Do you need LegitScript for a high risk merchant account for peptides?
It depends on the processor, not on Visa or Mastercard. Some providers that publicly advertise peptide accounts require it: Corepay has required LegitScript certification for peptide platforms since 1 April 2024 and says it does not support research-use-only sellers, and Easy Pay Direct says you “MUST be Legit Script certified”. At least one peptide-focused marketplace says certification “is not required by the card networks”. Both can be true, because it’s a requirement some processors and their banks set, not a published network rule for peptides.
The catch for RUO stores is eligibility. LegitScript’s Healthcare Certification is aimed at pharmacies, telemedicine, med spas and similar healthcare merchants, and no source we’ve found says it certifies research-use-only peptide sellers. If you’re a clinic or telehealth brand, certification is a realistic route. If you’re an RUO supplier, expect a smaller set of providers and tighter terms. We go through this properly in what LegitScript is and who it certifies.
Documents underwriters will ask for
Every provider has its own form, but the file usually looks like this. Gather it before you apply, because a half-finished application tends to sit in a queue.
Business and owners
– Formation documents (articles of incorporation or organization) and your tax ID letter
– Government ID for each owner, typically anyone holding 25% or more
– A bank letter or voided check for the settlement account, in the business’s legal name
– Consent for a personal credit check and, often, a personal guarantee
Processing history
– Three to six months of processing statements, if you’ve processed before
– Any closure or termination notices from previous providers, with a short explanation
Products and operations
– A complete product list with SKUs and prices
– A certificate of analysis for every product, matched to the batch you’re selling
– Supplier invoices showing where stock comes from
– Fulfillment details: where you ship from, carriers, typical delivery times, countries served
– Projected monthly volume, average order value and your largest expected order
Website
– Live refund, shipping, privacy and terms pages
– A contact page with a physical address and phone number
– Checkout that shows the total, the policies and how the charge will appear on a statement
Underwriters review the website as closely as the paperwork. If the site still has dosing content, reconstitution calculators or effect-based reviews, fix that first. Our first-week plan after a PayPal or Stripe closure has the full clean-up list.
Realistic terms: reserves, rates and timing
Reserves. A reserve is money the bank holds back from your settlements to cover future chargebacks and refunds. Published figures, at the time of writing (late 2026):
| Source | Reserve | Holding period |
|---|---|---|
| PXP (payments glossary) | typically 5 to 10% of daily settlement | typically 90 to 180 days |
| Corepay | typically 5 to 15%, can be higher | usually 90 to 180 days |
| Binderr (peptides specifically) | 5 to 10% of sales | 120 to 180 days |
Reserves come in three shapes: rolling (a percentage of each settlement, released after the holding period), capped (rolling until a set amount is reached) and upfront (a lump sum before you go live). Not every account requires one, but plan as if yours will.
Here’s what a rolling reserve does to cash flow. Say a store processes $40,000 a month with a 10% rolling reserve held for 180 days. That’s $4,000 a month withheld, and nothing comes back until month seven, by which point about $24,000 is sitting with the bank. It isn’t lost, but it isn’t in your inventory budget either.
Rates. Binderr quotes card rates for peptide merchants around 3.5 to 5%. On top of that, expect some mix of per-transaction fees, a gateway fee, a monthly minimum, chargeback fees and registration pass-throughs. Ask for everything in one schedule and work out your effective rate on real order data.
Timing. Nobody publishes a reliable approval timeline for this category, so don’t plan a launch around a date a salesperson gave you. Treat it as weeks, and apply before you need the account, not after the old one closes.
Red flags in a provider
These are the ones we’d walk away from:
- “Guaranteed approval.” The acquiring bank decides. A broker can’t guarantee its decision.
- “We’ll code you as supplements” or any other category that isn’t what you sell. Visa’s acceptance risk standards require acquirers to keep key identifiers such as merchant names and MCC uniform, and to monitor for mismatches. PaymentCloud reports a $25,000 assessment per merchant when an acquirer alters merchant details to avoid VIRP registration. When the mismatch is found, the account is closed and the merchant, not the salesperson, ends up on MATCH for five years.
- “Use a different business name or website on the application.” Processing your sales through credentials approved for something else is what Visa calls transaction laundering: “an unknown business uses an approved Merchant’s payment credentials.”
- They can’t tell you who the acquiring bank is. You need to know whose rules you’re living under.
- No questions about your website or products. An underwriter who doesn’t look now will look later, after you’ve built a business on the account.
- “Just take the dosing pages down until you’re approved.” Monitoring continues after approval. A site that changes back is grounds for termination.
How to make the application clean
- Fix the site first. Every page, every channel. The business has to actually operate as research-use-only if that’s how you’re applying.
- Match every identifier. Legal name, trading name, domain, bank account name and the statement descriptor you request should all line up.
- Build the COA set. One per product, matched to the batch, with a verification link from the lab where one exists.
- Write a one-page business summary. What you sell, who buys it, how you qualify buyers, how you handle refunds and where you ship. Underwriters appreciate not having to guess.
- Be honest about volume and history. Inflated projections and hidden closures are what turn an approval into a termination later.
- Apply to one or two providers at a time. Spraying ten applications creates noise and doesn’t speed anything up.
- Read the agreement before signing. Reserve terms, how the reserve can change, termination notice, early termination fees. Ask questions in writing.
What we’d do this week
If you don’t have a merchant account yet, start the document list today and audit the site against the clean-up list before anything goes to an underwriter. If you’re a clinic or telehealth brand, look at certification first, because it opens doors that are closed to everyone else. If you’re an RUO supplier, accept that the terms will be tighter and build the reserve into your cash plan now.
We work with research suppliers who want to run a clean, defensible business, and with clinics and telehealth brands that can qualify for certification. We don’t help anyone dress up human-use sales as research. Because the rules here keep moving, have a lawyer familiar with FDA and FTC rules review your positioning before you apply.
If you’d rather have someone check your site and file against an underwriter’s list before it goes out, that’s part of our peptide payment processing setup.
Frequently asked questions
What is a high risk merchant account for peptides?
It’s a merchant account with an acquiring bank that accepts higher-risk categories, underwritten before you start processing. For peptide stores it typically comes with a reserve, higher rates and ongoing monitoring of your site and dispute levels.
Do I need LegitScript certification to get a peptide merchant account?
Some processors require it, including some that advertise peptide accounts, but it isn’t a published Visa or Mastercard rule for peptides. LegitScript certification is aimed at healthcare merchants, so research-use-only stores generally won’t qualify and will need a provider that doesn’t require it.
How much is the reserve on a high risk merchant account?
Published figures typically range from 5 to 10% of settlements held for 90 to 180 days, with some providers going to 15% or higher. One peptide-focused source quotes 5 to 10% held for 120 to 180 days. Your actual terms depend on your history, volume and the bank.
Can I get a merchant account if I’m on the MATCH list?
It’s much harder. MATCH listings stay active for five years, and most acquirers decline listed merchants outright. If you’re listed, be upfront about it and expect very limited options.
